BLKn 0 Posted June 29, 2014 Share Posted June 29, 2014 When I click the Computer Scan icon, it immediately opens Custom Scan. In the window under Profile, items are listed with a checkbox to show what is being scanned. If I connect a Flash Drive, it appears in the list under Macintosh HD, which always has a checkbox and is always scanned. On a few occasions, "Boot OS X" appeared below Macintosh HD with its own arrow and checkbox. I did not connect anything to the computer when this happened; not even my flash drive. Why did "Boot OS X" appear and what was ESET picking up? What does this reference? Please note that in the attached snapshots, I did attach a flash drive (Untitled/Twollog). However, I have attached this same flash drive without Boot OS X showing up, so the appearance of Boot OS X is a separate issue. Thank you Link to comment Share on other sites More sharing options...
Most Valued Members planet 232 Posted June 30, 2014 Most Valued Members Share Posted June 30, 2014 (edited) Hi BLKn, Do you use Time Machine for that flash drive or any other flash drive / external hard drive? How about Carbon Copy Cloner? Any recent software updates performed? In recent releases, OS X adds a new hidden boot EFI partition on the Time Machine disk, possibly named "Boot OS X". I'm not sure if hidden partitions like this one are an issue with Cyber Security, as I think it just grabs whatever partitions are available (both hidden and visible)... However someone from ESET may need to confirm this. Edited July 2, 2014 by planet Link to comment Share on other sites More sharing options...
BLKn 0 Posted June 30, 2014 Author Share Posted June 30, 2014 Thank you, Planet. Since installing ESET software, the only device I have connected to this Mac are USB flash drives. I do use a LaCie backup external drive and Time Machine -- but only when I connect it to the computer. This is not something that happens automatically. I am concerned about someone cloning this system and doing a backup without my knowledge. Is there any way to detect some sort of hidden mirroring? Thank you! Link to comment Share on other sites More sharing options...
Most Valued Members planet 232 Posted July 1, 2014 Most Valued Members Share Posted July 1, 2014 (edited) When looking at Time Machine Preferences, if the switch is moved to the 'Off' position (so you manually connect the external drive and click 'Back Up Now') and you can only see your LaCie external drive listed - it seems unlikely that there's anyone else using Time Machine on your Mac... keep your Mac secure from unwanted physical access and if you've completed a deep scan of your Mac (Open ESET Cyber Seuciry > Computer Scan > 'Deep Scan'), it seems unlikely. Consider using FileVault in the Security section of System Preferences in order to encrypt your Mac, and even encrypting your Time Machine backup, which is done by adding a device to Time Machine with 'Encrypt backups' enabled. - Edit: So after checking my setup, ESET does not show "Boot OS X" even though I've connected my Time Machine device. I've edited a few things to make sure I wasn't giving the wrong information - it's hard to know what an exact issue is without sufficiently diagnosing your Mac. After further research, you may be seeing it due to a bad OS X upgrade recently, a misconfigured Time Machine (when OS X tried to add it's recovery partition to your backup external drive), your storage device in your mac being formatted in a nonstandard way... it could also be something else, once again I can't be sure. I may be wrong, but I think ESET is simply listing that drive, partition, etc. in their application and wouldn't be the cause of why you're seeing "Boot OS X". You could contact Apple Support or head on over to the Apple Support Communities website to get a more accurate answer regarding the "Boot OS X" issue. Edited July 2, 2014 by planet Link to comment Share on other sites More sharing options...
Recommended Posts